Due to the cost, though, they have to be carried out by a motivated adversary bent on harm since there is little way to reap monetary profit from them aside from blackmailing potential victims with threats of crippling their servers.

Internet root servers were attacked in 2002, but the attacks were blunted enough for the servers to recover without a major take-down of the Internet itself. After the attack, limits on the Internet Control Message Protocol (ICMP) messages these servers will accept were set to ensure that type of attack in the future wouldn't succeed. The 13 root servers targeted run as the master directory for lookups that match domain names with their corresponding IP addresses

During the height of the Storm worm attacks in 2007, a security researcher revealed that the people behind it or the worm itself was launching DD0S attacks against researchers trying to figure out a way to defeat it. The worm was able to figure out which users were trying to probe its command-and-control servers, and it retaliated by launching DDoS attacks that shut down their Internet access for days, said Josh Corman, now an analyst with the 451 Group.

Georgia cyberattacks linked to Russian organized crime

DDoS attacks aganst the country of Georgia were seen as a way to soften up the country in preparation for a five-day military invasion by Russia in 2007. About a year later the U.S. Cyber Consequences Unit, an independent research institute concluded the attacks were launched by Russian criminal gangs in sympathy with the Russian government.

Mikko Hypponen, the Chief Research Officer of Internet security firm F-Secure, said of the attacks, "Launching DDoS attacks against services like Facebook is the equivalent of bombing a TV station because you don't like one of the newscasters."

A loosely organized group of Internet hacktivists called Anonymous took down Visa's website Dec. 7, 2010 after organizing similar attacks on Mastercard and PayPal. Anonymous, had been encouraging volunteers to download software called LOIC (Low Orbit Ion Cannon), which let them centrally control these systems and direct them into a DDoS. The point of the attacks was to put pressure on financial companies that recently cut ties with the WikiLeaks website over its publication of more than a quarter million U.S. Department of State classified cables.